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DETAILED ACTION 

This is a Non-Final Office Action Correspondence in response to Request for Continued 
Examination for U.S. Application No. 10/792254 filed on June 18, 2008. Claims 1-25 and 27-31 
are pending. 



Claim Rejections - 35 USC § 103 

1 . The following is a quotation of 35 U.S. C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

2. Claims 1-31 are rejected under 35 U.S.C. 103(a) as being unpatentable over Warhol 

Worms: The Potential for Very Fast Internet Plagues to Weaver (denoted herein as "Weaver") 
(IDS submitted December 17, 2007) and in further view of Simulating and Optimizing Worm 
Propagation Algorithms to Vogt (denoted herein as "Vogt") (IDS submitted December 17, 
2007). 



3. As to Claims 1, 9, and 17, Weaver discloses a method, system, and computer readable 
medium bearing computer readable instructions (referenced hereinafter as the method) for 
propagating data over a network, comprising: 
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determining a sequential first set of network addresses (Weaver; New Infection 
Strategies, discloses determining a sequential first set of network addresses; i.e. the IP address 
space); 

mapping a range of addresses in the sequential first set of network addresses to a second 
set of addresses wherein the second set of addresses is a one to one mapping of the address from 
the first set and wherein the addresses in the second set are not in increasing address order 
(Weaver; New Infection Strategies, discloses a one to one mapping of the first set of addresses to 
a second set of addresses by generating a permutation of the first set of addresses) (see also 
Laplante - Dictionary of Computer Science Engineering and Technology; for a definition of 
permutation as a rearrangement of elements where none are lost, added, or changed, in this case, 
a rearrangement of the IP address space); 

traversing the second set of addresses to find another element of the network (Weaver; 
Active Worms, Existing Infection Strategies, and New Infection Strategies, discloses a 
permutation scan where the permutation, or second set, of addresses is traversed to find another 
element of the network); 

transferring the data to the another element of the network along with an indication of at 
least a portion of the addresses remaining in the second set [. . .] (Weaver; New Infection 
Strategies, discloses transferring the data and a portion of the addresses remaining in the second 
set to another element of the network). 

Weaver (New Infection Strategies) discloses a partitioned permutation scan where a 
range of addresses in the permutation are transferred to another element. Hence, Weaver 
discloses transferring the data to the another element of the network and specifying a range of 
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addresses in the second set of addresses. Weaver's disclosure implies but is not explicit 
regarding providing the indication of at least a portion of the addresses. Vogt, however, 
discloses transferring the data to the another element of the network along with an indication of 
at least a portion of the addresses remaining in the second set by specifying a range of addresses 
in the second set of addresses (Vogt; 4.4 Subdividing, transferring data to another element of the 
network with an indication of a portion of addresses by specifying a range of addresses). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify, transferring data to another element, as disclosed by Weaver, to include 
transferring the data by providing an indication of a portion of addresses, as disclosed by Vogt. 

One of ordinary skill in the art at the time the invention was made would have been 
motivated to make this combination in order to provide faster propagation of software over an 
address space (Vogt; 4.4 Subdividing). 

Weaver further discloses wherein traversed addresses of the second set of addresses are 
excluded from the specified range of addresses (Weaver; New Infection Strategies; the newly 
infected worm takes a range of addresses that exclude the range the original worm traverses). 

4. As to Claims 2, 10, and 18, Weaver and Vogt in combination disclose each and every 
limitation of Claims 1, 9, and 17. Weaver fiirther discloses the mapping is a fiinction based on a 
primitive element (Weaver; New Infection Strategies, discloses the permutation is based on a 

preselected key). 
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5. As to Claims 3,11, and 19, Weaver and Vogt in combination disclose each and every 
limitation of Claims 1,9, and 17. Vogt further discloses traversing the second set of addresses to 
find a second element of the computer network and transferring the data to the second element of 
the computer network and an indication of at least a second portion of the addresses remaining in 
the second set that have not been traversed (Vogt; 4.4 Subdividing, discloses traversing a set of 
addresses to find a second element of the computer network and transferring the data to the 
second element with an indication of a second portion of the addresses remaining in the set that 
have not been traversed). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify, traversing a set of addresses to find an element and transferring to the 
element data with an indication of a portion of addresses in the set, as disclosed by Weaver, to 
include finding and transferring data with a second portion of addresses remaining in the set that 
have not been traversed to another element, as disclosed by Vogt. 

One of ordinary skill in the art at the time the invention was made would have been 
motivated to make this combination in order to provide a more efficient method of propagating 
software over an address space (Vogt; 4.4 Subdividing). 

6. As to Claims 4, 12, and 20, Weaver and Vogt in combination disclose each and every 
limitation of Claims 1, 9, and 17. Weaver further discloses the indication of the at least a portion 
of the addresses remaining comprises a function used to perform that mapping (Weaver; New 
Infection Strategies, discloses the indication includes the permutation scan algorithm applied by 
each worm). 
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7. As to Claims 5,13, and 21, Weaver and Vogt in combination disclose each and every 
limitation of Claims 1, 9, and 17. Weaver further discloses the network comprises Intemet 
Protocol addresses (Weaver; New Infection Strategies, discloses the network comprising IP 
addresses). 

8. As to Claims 6, 14, and 22, Weaver and Vogt in combination disclose each and every 
limitation of Claims 5, 13, and 21. Weaver further discloses the network is coupled to the 
Intemet (Weaver; New Infection Strategies, discloses the network is coupled to the Intemet). 

9. As to Claims 7, 15, and 23, Weaver and Vogt in combination disclose each and every 
limitation of Claims 5, 13, and 21. Weaver further discloses the network comprises a subnet 
(Weaver; New Infection Strategies, discloses the network comprises a subnet). 

10. As to Claims 8, 16, and 24, Weaver and Vogt in combination disclose each and every 
limitation of Claims 1, 9, and 17. Weaver further discloses the element of the computer network 
comprises a computing device (Weaver; New Infection Strategies, discloses the element of the 
network is a computing device). 

1 1 . Claims 25 and 27-3 1 are rejected under 35 U.S. C. 103(a) as being unpatentable over 
Weaver, and in further view of Vogt and U.S. Patent No. 5,377,207 to Perlman. 
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12. As to Claim 25 , Weaver discloses : 

(a) determining a sequential first set of network addresses (Weaver; New Infection 
Strategies, discloses determining a sequential first set of network addresses; i.e. the IP address 

space)); 

(b) mapping a range of addresses in the sequential first set of network addresses to a 
second set of addresses wherein the second set of addresses is a one to one pseudo-random 
mapping of the range of addresses in the first set and wherein the addresses in the second set are 
not in increasing address order wherein the mapping is a function based on [. . .] a primitive 
element (Weaver; New Infection Strategies, discloses a one to one mapping of the first set of 
addresses to a second set of addresses by generating a permutation of the first set of addresses) 
(see also Laplante - Dictionary of Computer Science Engineering and Technology; for a 
definition of permutation as a rearrangement of elements where none are lost, added, or changed, 
in this case, a rearrangement of the IP address space) (Weaver; New Infection Strategies, 
discloses the permutation is based on a preselected key); 

Weaver does not explicitly disclose, however Perlman discloses that the mapping 
function is based on powers of a primitive element (Perlman; Abstract and column 13 lines 6- 
21). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify a permutation of a range of address, as disclosed by Weaver, to include 
using powers of a primitive element to perform the permutation, as disclosed by Perlman, in 
order to apply known methods of performing permutations. 
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Weaver does not explicitly disclose, however Vogt discloses: 

(c) traversing the second set of addresses to locate at least two other elements of the 
network (Vogt; 4.4 Subdividing, discloses traversing a set of addresses to locate two elements of 
a network); 

(d) subdividing the addresses of the second set of addresses that were not traversed in act 
(c) into a plurality of portions, wherein addresses of the second set of addresses that were 
traversed in act (c) are excluded from the portions (Vogt; 4.4 Subdividing; the range of addresses 
sent are the addresses the parent fraversed plus 1, i.e. the fraversed addresses are excluded); 

(e) fransferring a set of computer readable instructions to the at least two other elements 
of the network to carry out a distributed computing function (Vogt; 4.4 Subdividing, discloses 
transferring the worm and propagation algorithm to at least two other elements of the network) 
(see also Weaver; Abstract and New Infection Strategies, discloses the worm, which comprises 
self executing instructions, propagating through address space by transferring copies of itself to 
other elements of the network); and 

(f) transferring an indication of at least a portion of the addresses remaining in the second 
set by specifying a range of addresses in the second set of addresses along with a set of 
computer-readable instructions for carrying out acts (a) through (e) to a respective element of the 
at least two other elements (Vogt; 4.4 Subdividing, discloses fransferring, to the two elements, 
the worm along with an indication of a portion of addresses remaining in the second set by 
specifying a range of addresses, in this case, half the address space) (see also Weaver; Abstract 
and New Infection Sfrategies, discloses the worm, which comprises self executing instructions, 
propagating through address space by fransferring copies of itself to other elements of the 
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network with an indication of a portion of addresses remaining in the permutation, or second set, 
of addresses). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify determining and mapping, as disclosed by Weaver, to include traversing and 
transferring to at least two other element, as disclosed by Vogt. 

One of ordinary skill in the art at the time the invention was made would have been 
motivated to make this combination in order to provide faster propagation of software over an 
address space (Vogt; 4.4 Subdividing). 

13. As to Claim 27, Weaver, Vogt, and Perlman in combination disclose each and every 
limitation of Claim 25. Weaver fiirther discloses the indication of the at least a portion of the 
addresses remaining comprises a fiinction used to perform that mapping (Weaver; New Infection 
Strategies, discloses the indication includes the permutation scan algorithm applied by each 
worm). 

14. As to Claim 28, Weaver, Vogt, and Perlman in combination disclose each and every 
limitation of Claim 25. Weaver further discloses the network comprises Internet Protocol 
addresses (Weaver; New Infection Strategies, discloses the network comprising IP addresses). 

15. As to Claim 29, Weaver, Vogt, and Perlman in combination disclose each and every 
limitation of Claim 25. Weaver fiirther discloses the network is coupled to the Internet 
(Weaver; New Infection Strategies, discloses the network is coupled to the Intemet). 
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16. As to Claim 30, Weaver, Vogt, and Perlman in combination disclose each and every 
limitation of Claim 25. Weaver further discloses the network comprises a subnet (Weaver; New 
Infection Strategies, discloses the network comprises a subnet). 

17. As to Claim 3 1 , Weaver, Vogt, and Perlman in combination disclose each and every 
limitation of Claim 25. Weaver further discloses the element of the computer network comprises 
a computing device (Weaver; New Infection Strategies, discloses the element of the network is a 
computing device). 

Conclusion 

18. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

Weaver et al. A Taxonomy of Computer Worms. October 27, 2003. 
Stamford et al. Top Speed of Flash Worms. October 29, 2004. 

Ma et al. Self-Stopping Worms. November 11, 2005. 

Salomon, David. Foundations of Computer Security - Worms. March 20, 2006. 
Laplante, Phillip A. Dictionary of Computer Science, Engineering, and Technology. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to VIVEK KRISHNAN whose telephone number is (571) 270- 
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5009. The examiner can normally be reached on Monday through Friday from 9:00 AM to 5 :30 
PM EST. 

If attempts to reach the examiner by telephone are unsuccessfiil, the examiner's 
supervisor, Jason Cardone can be reached on (571) 272-3933. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an apphcation may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Elecfronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



VK 



/Jason D Cardone/ 
Supervisory Patent Examiner, Art Unit 2445 



